   "Settings from Puppet that are necessary for CA initialization
    and request handling during normal Puppet operation.
    Most of these are Puppet configuration settings."
-  {:autosign              (schema/either schema/Str Boolean)
-   :allow-duplicate-certs Boolean
+  {:autosign              (schema/either schema/Str schema/Bool)
+   :allow-duplicate-certs schema/Bool
    :cacert                schema/Str
    :cacrl                 schema/Str
    :cakey                 schema/Str

        private-key  (utils/get-private-key keypair)
        x500-name    (utils/cn master-certname)
        ca-x500-name (utils/cn ca-name)
        [not-before
         not-after]  (cert-validity-dates ca-ttl)
        hostcert     (utils/sign-certificate ca-x500-name ca-private-key
                                             (next-serial-number! serial-file)
                                             not-before
                                             not-after
                                             x500-name public-key
                                             extensions)]
    (write-cert-to-inventory! hostcert inventory-file)

        public-key  (utils/get-public-key keypair)
        private-key (utils/get-private-key keypair)
        x500-name   (utils/cn (:ca-name ca-settings))
        validity    (cert-validity-dates (:ca-ttl ca-settings))
        cacert      (utils/sign-certificate
                      x500-name
                      private-key
                      (next-serial-number! (:serial ca-settings))
                      (:not-before validity)
                      (:not-after validity)
                      x500-name
                      public-key)
        cacrl       (-> cacert
